Terms of service

Last updated 22 August 2026

These terms govern your use of GrantRoster, provided by GrantRoster (sole trader), Netherlands (“we”, “us”). By running a scan or buying a report you agree to them. Please read the section on what the report is and is not — it is the most important part.

1. What the service does

GrantRoster performs a single, read-only, point-in-time scan of a Google Workspace domain that you administer, and produces an access-risk report: a score, a grade, findings, and a prioritised list of suggested fixes. The scan uses read-only Google Admin SDK permissions granted by a Workspace super administrator. We request no write permissions and perform no remediation on your systems.

2. Who may use it

You may connect a Google Workspace domain only if you are authorised to do so by the organisation that owns it — in practice, if you are a super administrator of that domain or have been instructed by one. If you run scans on behalf of clients, you are responsible for having their authorisation. The service is offered to organisations, not to consumers, and you must be able to enter a contract on behalf of your organisation.

3. Price and payment

A report is a one-time purchase, not a subscription: €149 for organisations of up to 50 accounts and €299 for 51 to 200 accounts, each excluding any VAT that applies. Organisations above 200 accounts are quoted individually. You can always see your score and category counts for free; payment unlocks the detailed findings, the fix-it checklist and the printable report. Payments are processed by Stripe; we never receive or store your card details.

4. Refunds

If the scan fails to produce a usable report for technical reasons on our side, tell us within 14 days and we will refund the purchase in full. Because the report is delivered immediately on payment, we do not otherwise offer refunds for a report that was generated successfully — a low score is a finding, not a fault. If you think something is wrong with your report, email hello@statmd.uk and we will look at it.

What a refund does to your access. A full refund ends your access to the paid report. Once Stripe confirms the refund we mark that payment refunded, and your organisation's reports go back to the free view: the score, the grade and the category counts stay visible, while the detailed findings, the fix-it checklist and the printable report lock again. Anything you had already printed or saved is of course yours to keep. If your organisation holds a second purchase that has not been refunded, that purchase keeps the reports unlocked. A partial refund, agreed with us as a goodwill credit, leaves your access unchanged.

5. What the report is — and what it is not

This section limits what you may rely on the report for. It is deliberately blunt.

• The report is a point-in-time snapshot. It describes your Workspace as it was at the moment of the scan and says nothing about any other moment. It is not monitoring and does not alert you to later changes.
• The report provides visibility, not protection. It does not prevent, detect or stop a breach, an intrusion or a misuse of credentials, and running it does not make your organisation secure.
• The report is not a compliance certification, audit opinion or attestation. It is not evidence of compliance with the GDPR, NIS2, ISO 27001, SOC 2 or any other framework, and must not be presented as such.
• The report is not legal advice and not a substitute for professional security or legal counsel.
• The findings are generated automatically from the metadata Google returns. They may be incomplete — for example where your Workspace edition does not expose a data source, or where Google declines a request — and the report states when a section is unavailable or partial. Decisions about your systems remain yours.

6. Your data

What we read, store, share and delete is set out in our privacy policy, which forms part of these terms. In short: metadata and aggregate counts only, hosted in the EU, and hard-deletable from your dashboard at any time. We request no Drive or Gmail access, and we never store, log, return or render file names, file identifiers or file contents. Where we process Workspace data we do so as your processor; a data processing agreement is available on request.

7. Acceptable use

Do not use the service to scan a domain you are not authorised to scan, attempt to circumvent the payment gate or the access controls, probe or disrupt the service, or resell the report as though it were your own product without telling your client that a third-party tool produced it. We may suspend an account that does any of these.

8. Availability

We aim to keep the service available but do not promise uninterrupted service, and we may change or discontinue features. The service depends on Google’s APIs; if Google changes, restricts or withdraws the permissions the scan relies on, parts of the report may become unavailable through no fault of ours.

9. Liability

Nothing in these terms excludes liability that cannot lawfully be excluded, including for death or personal injury caused by negligence, for fraud, or for intent or gross negligence on our part. Subject to that, and to the fullest extent permitted by law: we provide the service and the report as-is; we exclude liability for indirect or consequential loss, for loss of profit, revenue, goodwill or data, and for any security incident the report did not predict or prevent; and our total aggregate liability arising out of or in connection with the service is limited to the amount you paid us for the report giving rise to the claim.

10. Termination

You may stop using the service at any time and delete your data from the dashboard. We may suspend or terminate access for a material breach of these terms. Reports you have already paid for remain available to you unless you delete them, or the purchase that unlocked them is refunded in full (section 4).

11. Changes to these terms

We may update these terms. The date at the top of this page shows when they last changed, and the version in force when you buy a report is the version that governs that purchase.

12. Governing law

These terms are governed by the law of the Netherlands, and disputes will be submitted to the competent court in Amsterdam, the Netherlands. If any provision is held unenforceable, the rest continues to apply.

Contact

GrantRoster (sole trader) · hello@statmd.uk